)]}'
{"doc/source/policy_mapping.rst":[{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"7065fd267eaf43a77c19c0fd80e4e81d1d094822","unresolved":false,"context_lines":[{"line_number":73,"context_line":"identity:update_role                                       PATCH /v3/roles/{role_id}"},{"line_number":74,"context_line":"identity:delete_role                                       DELETE /v3/roles/{role_id}"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"identity:get_domain_role                                   GET /v3/roles/{role_id} where role.domain_id is not null"},{"line_number":77,"context_line":"identity:list_domain_roles                                 GET /v3/roles?domain_id where role.domain_id is not null"},{"line_number":78,"context_line":"identity:create_domain_role                                POST /v3/roles where role.domain_id is not null"},{"line_number":79,"context_line":"identity:update_domain_role                                PATCH /v3/roles/{role_id} where role.domain_id is not null"}],"source_content_type":"text/x-rst","patch_set":21,"id":"dae33548_466276ae","line":76,"range":{"start_line":76,"start_character":83,"end_line":76,"end_character":115},"updated":"2016-02-16 19:48:04.000000000","message":"Should be nice to have them in a comment above this block rather than repeating for every API","commit_id":"a16287af5b7761c8453b2a8e278d78652497377c"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"7065fd267eaf43a77c19c0fd80e4e81d1d094822","unresolved":false,"context_lines":[{"line_number":74,"context_line":"identity:delete_role                                       DELETE /v3/roles/{role_id}"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"identity:get_domain_role                                   GET /v3/roles/{role_id} where role.domain_id is not null"},{"line_number":77,"context_line":"identity:list_domain_roles                                 GET /v3/roles?domain_id where role.domain_id is not null"},{"line_number":78,"context_line":"identity:create_domain_role                                POST /v3/roles where role.domain_id is not null"},{"line_number":79,"context_line":"identity:update_domain_role                                PATCH /v3/roles/{role_id} where role.domain_id is not null"},{"line_number":80,"context_line":"identity:delete_domain_role                                DELETE /v3/roles/{role_id} where role.domain_id is not null"}],"source_content_type":"text/x-rst","patch_set":21,"id":"dae33548_46d43646","line":77,"range":{"start_line":77,"start_character":73,"end_line":77,"end_character":82},"updated":"2016-02-16 19:48:04.000000000","message":"domain_id\u003d{domain_id}","commit_id":"a16287af5b7761c8453b2a8e278d78652497377c"}],"etc/policy.json":[{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"1157035b2441bbbe0ac0d02863cc901b8c9f8010","unresolved":false,"context_lines":[{"line_number":79,"context_line":"    \"identity:list_domain_roles\": \"rule:admin_required\","},{"line_number":80,"context_line":"    \"identity:create_domain_role\": \"rule:admin_required\","},{"line_number":81,"context_line":"    \"identity:update_domain_role\": \"rule:admin_required\","},{"line_number":82,"context_line":"    \"identity:delete_domain_role\": \"rule:admin_required\","},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"    \"identity:get_implied_role\": \"rule:admin_required \","},{"line_number":85,"context_line":"    \"identity:list_implied_roles\": \"rule:admin_required\","}],"source_content_type":"application/json","patch_set":17,"id":"3a57f1b5_10f077c8","line":82,"updated":"2016-02-12 02:57:07.000000000","message":"DSRs are pretty useless with the vanilla default policy.json. But whatever.","commit_id":"238a792499163c6231fd1cac0f0d08447897810b"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"615efe7f11835124a5b05298e527aee2281709f4","unresolved":false,"context_lines":[{"line_number":79,"context_line":"    \"identity:list_domain_roles\": \"rule:admin_required\","},{"line_number":80,"context_line":"    \"identity:create_domain_role\": \"rule:admin_required\","},{"line_number":81,"context_line":"    \"identity:update_domain_role\": \"rule:admin_required\","},{"line_number":82,"context_line":"    \"identity:delete_domain_role\": \"rule:admin_required\","},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"    \"identity:get_implied_role\": \"rule:admin_required \","},{"line_number":85,"context_line":"    \"identity:list_implied_roles\": \"rule:admin_required\","}],"source_content_type":"application/json","patch_set":17,"id":"3a57f1b5_524b4f2a","line":82,"in_reply_to":"3a57f1b5_10f077c8","updated":"2016-02-12 07:36:16.000000000","message":"agreed!","commit_id":"238a792499163c6231fd1cac0f0d08447897810b"}],"etc/policy.v3cloudsample.json":[{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"f42b4663e4195caee00e5c50eb8796ce29b95c85","unresolved":false,"context_lines":[{"line_number":83,"context_line":"    \"global_role_rules_for_list\": \"rule:admin_required and None:%(domain_id)s\","},{"line_number":84,"context_line":"    \"domain_admin_of_dsr\": \"rule:admin_required and domain_id:%(role.domain_id)s\","},{"line_number":85,"context_line":"    \"domain_admin_of_target_dsr\": \"rule:admin_required and domain_id:%(target.role.domain_id)s\","},{"line_number":86,"context_line":"    \"domain_admin_of_dsr_filter\": \"rule:admin_required and domain_id:%(domain_id)s\","},{"line_number":87,"context_line":"    \"project_admin_in_domain_of_target_dsr\": \"rule:admin_required and project_domain_id:%(target.role.domain_id)s\","},{"line_number":88,"context_line":"    \"project_admin_in_domain_of_dsr_filter\": \"rule:admin_required and project_domain_id:%(domain_id)s\","},{"line_number":89,"context_line":" "}],"source_content_type":"application/json","patch_set":9,"id":"9a68dd71_3cf0e990","line":86,"updated":"2016-01-22 23:28:33.000000000","message":"This isn\u0027t role-specific, so maybe we should move it up top where other things could use it, and drop dsr from the name... \"admin_of_filtered_domain\"?","commit_id":"a36f9ebd12015d75f013d6bca73b1d0e00f6144f"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"5574be96c7ab97faef39933f58ac9e349bb6c1a1","unresolved":false,"context_lines":[{"line_number":83,"context_line":"    \"global_role_rules_for_list\": \"rule:admin_required and None:%(domain_id)s\","},{"line_number":84,"context_line":"    \"domain_admin_of_dsr\": \"rule:admin_required and domain_id:%(role.domain_id)s\","},{"line_number":85,"context_line":"    \"domain_admin_of_target_dsr\": \"rule:admin_required and domain_id:%(target.role.domain_id)s\","},{"line_number":86,"context_line":"    \"domain_admin_of_dsr_filter\": \"rule:admin_required and domain_id:%(domain_id)s\","},{"line_number":87,"context_line":"    \"project_admin_in_domain_of_target_dsr\": \"rule:admin_required and project_domain_id:%(target.role.domain_id)s\","},{"line_number":88,"context_line":"    \"project_admin_in_domain_of_dsr_filter\": \"rule:admin_required and project_domain_id:%(domain_id)s\","},{"line_number":89,"context_line":" "}],"source_content_type":"application/json","patch_set":9,"id":"9a68dd71_d8389ef0","line":86,"in_reply_to":"9a68dd71_3cf0e990","updated":"2016-01-24 19:25:16.000000000","message":"It\u0027s true, it isn\u0027t role specific, but I think it aids readability having it here and \"specific\" to the role apis below.","commit_id":"a36f9ebd12015d75f013d6bca73b1d0e00f6144f"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"f42b4663e4195caee00e5c50eb8796ce29b95c85","unresolved":false,"context_lines":[{"line_number":85,"context_line":"    \"domain_admin_of_target_dsr\": \"rule:admin_required and domain_id:%(target.role.domain_id)s\","},{"line_number":86,"context_line":"    \"domain_admin_of_dsr_filter\": \"rule:admin_required and domain_id:%(domain_id)s\","},{"line_number":87,"context_line":"    \"project_admin_in_domain_of_target_dsr\": \"rule:admin_required and project_domain_id:%(target.role.domain_id)s\","},{"line_number":88,"context_line":"    \"project_admin_in_domain_of_dsr_filter\": \"rule:admin_required and project_domain_id:%(domain_id)s\","},{"line_number":89,"context_line":" "},{"line_number":90,"context_line":"    \"identity:get_role\": \"rule:cloud_admin or rule:dsr_rules_for_get or rule:global_role_rules_for_get\","},{"line_number":91,"context_line":"    \"identity:list_roles\": \"rule:cloud_admin or rule:dsr_rules_for_list or rule:global_role_rules_for_list\","}],"source_content_type":"application/json","patch_set":9,"id":"9a68dd71_7cd0a11f","line":88,"updated":"2016-01-22 23:28:33.000000000","message":"also not role-specific... \"project_admin_in_filtered_domain\" or the more accurate \"admin_of_project_in_filtered_domain\"?","commit_id":"a36f9ebd12015d75f013d6bca73b1d0e00f6144f"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"5574be96c7ab97faef39933f58ac9e349bb6c1a1","unresolved":false,"context_lines":[{"line_number":85,"context_line":"    \"domain_admin_of_target_dsr\": \"rule:admin_required and domain_id:%(target.role.domain_id)s\","},{"line_number":86,"context_line":"    \"domain_admin_of_dsr_filter\": \"rule:admin_required and domain_id:%(domain_id)s\","},{"line_number":87,"context_line":"    \"project_admin_in_domain_of_target_dsr\": \"rule:admin_required and project_domain_id:%(target.role.domain_id)s\","},{"line_number":88,"context_line":"    \"project_admin_in_domain_of_dsr_filter\": \"rule:admin_required and project_domain_id:%(domain_id)s\","},{"line_number":89,"context_line":" "},{"line_number":90,"context_line":"    \"identity:get_role\": \"rule:cloud_admin or rule:dsr_rules_for_get or rule:global_role_rules_for_get\","},{"line_number":91,"context_line":"    \"identity:list_roles\": \"rule:cloud_admin or rule:dsr_rules_for_list or rule:global_role_rules_for_list\","}],"source_content_type":"application/json","patch_set":9,"id":"9a68dd71_982786c9","line":88,"in_reply_to":"9a68dd71_7cd0a11f","updated":"2016-01-24 19:25:16.000000000","message":"as above","commit_id":"a36f9ebd12015d75f013d6bca73b1d0e00f6144f"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"c97dd54fd4230fd402f0acfa309df7fdb16ad568","unresolved":false,"context_lines":[{"line_number":76,"context_line":"    \"identity:ec2_create_credential\": \"rule:admin_required or rule:owner\","},{"line_number":77,"context_line":"    \"identity:ec2_delete_credential\": \"rule:admin_required or (rule:owner and user_id:%(target.credential.user_id)s)\","},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"    \"dsr_rules_for_get\": \"rule:domain_admin_of_target_dsr or rule:project_admin_in_domain_of_target_dsr\","},{"line_number":80,"context_line":"    \"global_role_rules_for_get\": \"rule:admin_required and None:%(target.role.domain_id)s\","},{"line_number":81,"context_line":"    \"dsr_rules_for_list\": \"rule:domain_admin_of_dsr_filter or rule:project_admin_in_domain_of_dsr_filter\","},{"line_number":82,"context_line":"    \"global_role_rules_for_list\": \"rule:admin_required and None:%(domain_id)s\","}],"source_content_type":"application/json","patch_set":14,"id":"5a5ae5dd_1996c44c","line":79,"updated":"2016-02-03 22:17:58.000000000","message":"Yuck.  Let\u0027s discuss the naming here.","commit_id":"4454d255b1f86de77ea56e04da4e60280aebb5ae"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"34814a124058f5649e4260e282dee4ccb9736dda","unresolved":false,"context_lines":[{"line_number":76,"context_line":"    \"identity:ec2_create_credential\": \"rule:admin_required or rule:owner\","},{"line_number":77,"context_line":"    \"identity:ec2_delete_credential\": \"rule:admin_required or (rule:owner and user_id:%(target.credential.user_id)s)\","},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"    \"get_domain_roles\": \"rule:domain_admin_matches_target_domain_role or rule:project_admin_matches_target_domain_role\","},{"line_number":80,"context_line":"    \"get_global_roles\": \"rule:admin_required and None:%(target.role.domain_id)s\","},{"line_number":81,"context_line":"    \"list_domain_roles\": \"rule:domain_admin_matches_filter_on_list_domain_roles or rule:project_admin_matches_filter_on_list_domain_roles\","},{"line_number":82,"context_line":"    \"list_global_roles\": \"rule:admin_required and None:%(domain_id)s\","}],"source_content_type":"application/json","patch_set":16,"id":"3a57f1b5_da81fc90","line":79,"updated":"2016-02-10 16:26:12.000000000","message":"These new roles and rules such as domain_admin_matches_filter_on_list_domain_roles need to be thoroughly explained with easy to read documentation and referenced in the release notes.  If not, no one will take the time to understand this stuff and learn how to modify/leverage it. To the untrained eye this stuff is not easy to consume","commit_id":"7bca1518df7323ce461161f98c035516f6bf07f5"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"3c2bb81c102485c56907475531fa002372d1260d","unresolved":false,"context_lines":[{"line_number":76,"context_line":"    \"identity:ec2_create_credential\": \"rule:admin_required or rule:owner\","},{"line_number":77,"context_line":"    \"identity:ec2_delete_credential\": \"rule:admin_required or (rule:owner and user_id:%(target.credential.user_id)s)\","},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"    \"get_domain_roles\": \"rule:domain_admin_matches_target_domain_role or rule:project_admin_matches_target_domain_role\","},{"line_number":80,"context_line":"    \"get_global_roles\": \"rule:admin_required and None:%(target.role.domain_id)s\","},{"line_number":81,"context_line":"    \"list_domain_roles\": \"rule:domain_admin_matches_filter_on_list_domain_roles or rule:project_admin_matches_filter_on_list_domain_roles\","},{"line_number":82,"context_line":"    \"list_global_roles\": \"rule:admin_required and None:%(domain_id)s\","}],"source_content_type":"application/json","patch_set":16,"id":"3a57f1b5_86600d37","line":79,"in_reply_to":"3a57f1b5_da81fc90","updated":"2016-02-10 17:25:00.000000000","message":"lets split the policy scoping between domain and global role inference rules.","commit_id":"7bca1518df7323ce461161f98c035516f6bf07f5"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"2a3114e107f85a7416cf1dc4ba609899d140fdb3","unresolved":false,"context_lines":[{"line_number":76,"context_line":"    \"identity:ec2_create_credential\": \"rule:admin_required or rule:owner\","},{"line_number":77,"context_line":"    \"identity:ec2_delete_credential\": \"rule:admin_required or (rule:owner and user_id:%(target.credential.user_id)s)\","},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"    \"get_domain_roles\": \"rule:domain_admin_matches_target_domain_role or rule:project_admin_matches_target_domain_role\","},{"line_number":80,"context_line":"    \"get_global_roles\": \"rule:admin_required and None:%(target.role.domain_id)s\","},{"line_number":81,"context_line":"    \"list_domain_roles\": \"rule:domain_admin_matches_filter_on_list_domain_roles or rule:project_admin_matches_filter_on_list_domain_roles\","},{"line_number":82,"context_line":"    \"list_global_roles\": \"rule:admin_required and None:%(domain_id)s\","},{"line_number":83,"context_line":"    \"domain_admin_matches_domain_role\": \"rule:admin_required and domain_id:%(role.domain_id)s\","},{"line_number":84,"context_line":"    \"domain_admin_matches_target_domain_role\": \"rule:admin_required and domain_id:%(target.role.domain_id)s\","},{"line_number":85,"context_line":"    \"domain_admin_matches_filter_on_list_domain_roles\": \"rule:admin_required and domain_id:%(domain_id)s\","}],"source_content_type":"application/json","patch_set":16,"id":"3a57f1b5_20758cf8","line":82,"range":{"start_line":79,"start_character":4,"end_line":82,"end_character":70},"updated":"2016-02-10 16:30:08.000000000","message":"I think it would be easier to read if these would be below the 5 rules just below, because these are actually using them","commit_id":"7bca1518df7323ce461161f98c035516f6bf07f5"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"1a8058534a4191b81f32bc130feef3f448e7bab2","unresolved":false,"context_lines":[{"line_number":76,"context_line":"    \"identity:ec2_create_credential\": \"rule:admin_required or rule:owner\","},{"line_number":77,"context_line":"    \"identity:ec2_delete_credential\": \"rule:admin_required or (rule:owner and user_id:%(target.credential.user_id)s)\","},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"    \"get_domain_roles\": \"rule:domain_admin_matches_target_domain_role or rule:project_admin_matches_target_domain_role\","},{"line_number":80,"context_line":"    \"get_global_roles\": \"rule:admin_required and None:%(target.role.domain_id)s\","},{"line_number":81,"context_line":"    \"list_domain_roles\": \"rule:domain_admin_matches_filter_on_list_domain_roles or rule:project_admin_matches_filter_on_list_domain_roles\","},{"line_number":82,"context_line":"    \"list_global_roles\": \"rule:admin_required and None:%(domain_id)s\","},{"line_number":83,"context_line":"    \"domain_admin_matches_domain_role\": \"rule:admin_required and domain_id:%(role.domain_id)s\","},{"line_number":84,"context_line":"    \"domain_admin_matches_target_domain_role\": \"rule:admin_required and domain_id:%(target.role.domain_id)s\","},{"line_number":85,"context_line":"    \"domain_admin_matches_filter_on_list_domain_roles\": \"rule:admin_required and domain_id:%(domain_id)s\","}],"source_content_type":"application/json","patch_set":16,"id":"3a57f1b5_41867866","line":82,"range":{"start_line":79,"start_character":4,"end_line":82,"end_character":70},"in_reply_to":"3a57f1b5_20758cf8","updated":"2016-02-10 19:54:23.000000000","message":"I agree.  Very good point!","commit_id":"7bca1518df7323ce461161f98c035516f6bf07f5"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"1157035b2441bbbe0ac0d02863cc901b8c9f8010","unresolved":false,"context_lines":[{"line_number":81,"context_line":"    \"identity:update_role\": \"rule:cloud_admin\","},{"line_number":82,"context_line":"    \"identity:delete_role\": \"rule:cloud_admin\","},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"    \"identity:get_domain_role\": \"rule:cloud_admin or rule:get_domain_roles\","},{"line_number":85,"context_line":"    \"identity:list_domain_roles\": \"rule:cloud_admin or rule:list_domain_roles\","},{"line_number":86,"context_line":"    \"identity:create_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_domain_role\","},{"line_number":87,"context_line":"    \"identity:update_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_target_domain_role\","}],"source_content_type":"application/json","patch_set":17,"id":"3a57f1b5_90978739","line":84,"range":{"start_line":84,"start_character":53,"end_line":84,"end_character":74},"updated":"2016-02-12 02:57:07.000000000","message":"why can\u0027t we just use rule:admin_and_matching_domain_id?","commit_id":"238a792499163c6231fd1cac0f0d08447897810b"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"615efe7f11835124a5b05298e527aee2281709f4","unresolved":false,"context_lines":[{"line_number":81,"context_line":"    \"identity:update_role\": \"rule:cloud_admin\","},{"line_number":82,"context_line":"    \"identity:delete_role\": \"rule:cloud_admin\","},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"    \"identity:get_domain_role\": \"rule:cloud_admin or rule:get_domain_roles\","},{"line_number":85,"context_line":"    \"identity:list_domain_roles\": \"rule:cloud_admin or rule:list_domain_roles\","},{"line_number":86,"context_line":"    \"identity:create_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_domain_role\","},{"line_number":87,"context_line":"    \"identity:update_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_target_domain_role\","}],"source_content_type":"application/json","patch_set":17,"id":"3a57f1b5_723f6b87","line":84,"range":{"start_line":84,"start_character":53,"end_line":84,"end_character":74},"in_reply_to":"3a57f1b5_90978739","updated":"2016-02-12 07:36:16.000000000","message":"see comment below","commit_id":"238a792499163c6231fd1cac0f0d08447897810b"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"1157035b2441bbbe0ac0d02863cc901b8c9f8010","unresolved":false,"context_lines":[{"line_number":86,"context_line":"    \"identity:create_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_domain_role\","},{"line_number":87,"context_line":"    \"identity:update_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_target_domain_role\","},{"line_number":88,"context_line":"    \"identity:delete_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_target_domain_role\","},{"line_number":89,"context_line":"    \"get_domain_roles\": \"rule:domain_admin_matches_target_domain_role or rule:project_admin_matches_target_domain_role\","},{"line_number":90,"context_line":"    \"list_domain_roles\": \"rule:domain_admin_matches_filter_on_list_domain_roles or rule:project_admin_matches_filter_on_list_domain_roles\","},{"line_number":91,"context_line":"    \"domain_admin_matches_domain_role\": \"rule:admin_required and domain_id:%(role.domain_id)s\","},{"line_number":92,"context_line":"    \"domain_admin_matches_target_domain_role\": \"rule:admin_required and domain_id:%(target.role.domain_id)s\","}],"source_content_type":"application/json","patch_set":17,"id":"3a57f1b5_f0c11b55","line":89,"range":{"start_line":89,"start_character":73,"end_line":89,"end_character":119},"updated":"2016-02-12 02:57:07.000000000","message":"is this kinda dangerous, that any project admin within the domain is effectively domain admin?","commit_id":"238a792499163c6231fd1cac0f0d08447897810b"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"615efe7f11835124a5b05298e527aee2281709f4","unresolved":false,"context_lines":[{"line_number":86,"context_line":"    \"identity:create_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_domain_role\","},{"line_number":87,"context_line":"    \"identity:update_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_target_domain_role\","},{"line_number":88,"context_line":"    \"identity:delete_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_target_domain_role\","},{"line_number":89,"context_line":"    \"get_domain_roles\": \"rule:domain_admin_matches_target_domain_role or rule:project_admin_matches_target_domain_role\","},{"line_number":90,"context_line":"    \"list_domain_roles\": \"rule:domain_admin_matches_filter_on_list_domain_roles or rule:project_admin_matches_filter_on_list_domain_roles\","},{"line_number":91,"context_line":"    \"domain_admin_matches_domain_role\": \"rule:admin_required and domain_id:%(role.domain_id)s\","},{"line_number":92,"context_line":"    \"domain_admin_matches_target_domain_role\": \"rule:admin_required and domain_id:%(target.role.domain_id)s\","}],"source_content_type":"application/json","patch_set":17,"id":"3a57f1b5_32c7b397","line":89,"range":{"start_line":89,"start_character":73,"end_line":89,"end_character":119},"in_reply_to":"3a57f1b5_f0c11b55","updated":"2016-02-12 07:36:16.000000000","message":"so for global roles, a project admin has always been able to get and list them  (they can\u0027t create/update/delete them, of course). So the same should be true for domain roles - the project admin should be able to get and list those for their own domain (but again, not create/update/delete them)","commit_id":"238a792499163c6231fd1cac0f0d08447897810b"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"1157035b2441bbbe0ac0d02863cc901b8c9f8010","unresolved":false,"context_lines":[{"line_number":87,"context_line":"    \"identity:update_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_target_domain_role\","},{"line_number":88,"context_line":"    \"identity:delete_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_target_domain_role\","},{"line_number":89,"context_line":"    \"get_domain_roles\": \"rule:domain_admin_matches_target_domain_role or rule:project_admin_matches_target_domain_role\","},{"line_number":90,"context_line":"    \"list_domain_roles\": \"rule:domain_admin_matches_filter_on_list_domain_roles or rule:project_admin_matches_filter_on_list_domain_roles\","},{"line_number":91,"context_line":"    \"domain_admin_matches_domain_role\": \"rule:admin_required and domain_id:%(role.domain_id)s\","},{"line_number":92,"context_line":"    \"domain_admin_matches_target_domain_role\": \"rule:admin_required and domain_id:%(target.role.domain_id)s\","},{"line_number":93,"context_line":"    \"domain_admin_matches_filter_on_list_domain_roles\": \"rule:admin_required and domain_id:%(domain_id)s\","}],"source_content_type":"application/json","patch_set":17,"id":"3a57f1b5_30a9f37b","line":90,"range":{"start_line":90,"start_character":4,"end_line":90,"end_character":138},"updated":"2016-02-12 02:57:07.000000000","message":"I don\u0027t understand this complexity. Isn\u0027t filtering has always been done at the code level instead of policy level?","commit_id":"238a792499163c6231fd1cac0f0d08447897810b"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"615efe7f11835124a5b05298e527aee2281709f4","unresolved":false,"context_lines":[{"line_number":87,"context_line":"    \"identity:update_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_target_domain_role\","},{"line_number":88,"context_line":"    \"identity:delete_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_target_domain_role\","},{"line_number":89,"context_line":"    \"get_domain_roles\": \"rule:domain_admin_matches_target_domain_role or rule:project_admin_matches_target_domain_role\","},{"line_number":90,"context_line":"    \"list_domain_roles\": \"rule:domain_admin_matches_filter_on_list_domain_roles or rule:project_admin_matches_filter_on_list_domain_roles\","},{"line_number":91,"context_line":"    \"domain_admin_matches_domain_role\": \"rule:admin_required and domain_id:%(role.domain_id)s\","},{"line_number":92,"context_line":"    \"domain_admin_matches_target_domain_role\": \"rule:admin_required and domain_id:%(target.role.domain_id)s\","},{"line_number":93,"context_line":"    \"domain_admin_matches_filter_on_list_domain_roles\": \"rule:admin_required and domain_id:%(domain_id)s\","}],"source_content_type":"application/json","patch_set":17,"id":"3a57f1b5_b23963a6","line":90,"range":{"start_line":90,"start_character":4,"end_line":90,"end_character":138},"in_reply_to":"3a57f1b5_30a9f37b","updated":"2016-02-12 07:36:16.000000000","message":"no, filtering protection has always been done in policy","commit_id":"238a792499163c6231fd1cac0f0d08447897810b"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"40777dbf277e5ac3d7d22c5dbc33ae822e1a0b8f","unresolved":false,"context_lines":[{"line_number":81,"context_line":"    \"identity:update_role\": \"rule:cloud_admin\","},{"line_number":82,"context_line":"    \"identity:delete_role\": \"rule:cloud_admin\","},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"    \"identity:get_domain_role\": \"rule:cloud_admin or rule:get_domain_roles\","},{"line_number":85,"context_line":"    \"identity:list_domain_roles\": \"rule:cloud_admin or rule:list_domain_roles\","},{"line_number":86,"context_line":"    \"identity:create_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_domain_role\","},{"line_number":87,"context_line":"    \"identity:update_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_target_domain_role\","},{"line_number":88,"context_line":"    \"identity:delete_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_target_domain_role\","},{"line_number":89,"context_line":"    \"get_domain_roles\": \"rule:domain_admin_matches_target_domain_role or rule:project_admin_matches_target_domain_role\","},{"line_number":90,"context_line":"    \"list_domain_roles\": \"rule:domain_admin_matches_filter_on_list_domain_roles or rule:project_admin_matches_filter_on_list_domain_roles\","},{"line_number":91,"context_line":"    \"domain_admin_matches_domain_role\": \"rule:admin_required and domain_id:%(role.domain_id)s\","},{"line_number":92,"context_line":"    \"domain_admin_matches_target_domain_role\": \"rule:admin_required and domain_id:%(target.role.domain_id)s\","},{"line_number":93,"context_line":"    \"domain_admin_matches_filter_on_list_domain_roles\": \"rule:admin_required and domain_id:%(domain_id)s\","},{"line_number":94,"context_line":"    \"project_admin_matches_target_domain_role\": \"rule:admin_required and project_domain_id:%(target.role.domain_id)s\","},{"line_number":95,"context_line":"    \"project_admin_matches_filter_on_list_domain_roles\": \"rule:admin_required and project_domain_id:%(domain_id)s\","},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"    \"identity:get_implied_role\": \"rule:cloud_admin\","},{"line_number":98,"context_line":"    \"identity:list_implied_roles\": \"rule:cloud_admin\","}],"source_content_type":"application/json","patch_set":17,"id":"3a57f1b5_3b24885e","line":95,"range":{"start_line":84,"start_character":4,"end_line":95,"end_character":115},"updated":"2016-02-11 20:15:14.000000000","message":"I think it would be easier to read if these were ordered in a way that rules that use others appear after them ?","commit_id":"238a792499163c6231fd1cac0f0d08447897810b"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"170d468099333392b799076e4e0ce3544aca0f4f","unresolved":false,"context_lines":[{"line_number":81,"context_line":"    \"identity:update_role\": \"rule:cloud_admin\","},{"line_number":82,"context_line":"    \"identity:delete_role\": \"rule:cloud_admin\","},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"    \"identity:get_domain_role\": \"rule:cloud_admin or rule:get_domain_roles\","},{"line_number":85,"context_line":"    \"identity:list_domain_roles\": \"rule:cloud_admin or rule:list_domain_roles\","},{"line_number":86,"context_line":"    \"identity:create_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_domain_role\","},{"line_number":87,"context_line":"    \"identity:update_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_target_domain_role\","},{"line_number":88,"context_line":"    \"identity:delete_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_target_domain_role\","},{"line_number":89,"context_line":"    \"get_domain_roles\": \"rule:domain_admin_matches_target_domain_role or rule:project_admin_matches_target_domain_role\","},{"line_number":90,"context_line":"    \"list_domain_roles\": \"rule:domain_admin_matches_filter_on_list_domain_roles or rule:project_admin_matches_filter_on_list_domain_roles\","},{"line_number":91,"context_line":"    \"domain_admin_matches_domain_role\": \"rule:admin_required and domain_id:%(role.domain_id)s\","},{"line_number":92,"context_line":"    \"domain_admin_matches_target_domain_role\": \"rule:admin_required and domain_id:%(target.role.domain_id)s\","},{"line_number":93,"context_line":"    \"domain_admin_matches_filter_on_list_domain_roles\": \"rule:admin_required and domain_id:%(domain_id)s\","},{"line_number":94,"context_line":"    \"project_admin_matches_target_domain_role\": \"rule:admin_required and project_domain_id:%(target.role.domain_id)s\","},{"line_number":95,"context_line":"    \"project_admin_matches_filter_on_list_domain_roles\": \"rule:admin_required and project_domain_id:%(domain_id)s\","},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"    \"identity:get_implied_role\": \"rule:cloud_admin\","},{"line_number":98,"context_line":"    \"identity:list_implied_roles\": \"rule:cloud_admin\","}],"source_content_type":"application/json","patch_set":17,"id":"3a57f1b5_58e05196","line":95,"range":{"start_line":84,"start_character":4,"end_line":95,"end_character":115},"in_reply_to":"3a57f1b5_3b24885e","updated":"2016-02-12 08:26:42.000000000","message":"OK, so want to make sure I understand which way round you prefer this....you felt it was better to have these \"lower level\" rules after where they are referenced (i.e. the api actions above this block) - so I did indeed move them here. That reference-before-definition is true of these lower-level urls too ( I think)....or were you thinking a different order is better?","commit_id":"238a792499163c6231fd1cac0f0d08447897810b"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"d99c592b0b9de8f7c695c8812bc7b5de1b4b04b2","unresolved":false,"context_lines":[{"line_number":81,"context_line":"    \"identity:update_role\": \"rule:cloud_admin\","},{"line_number":82,"context_line":"    \"identity:delete_role\": \"rule:cloud_admin\","},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"    \"identity:get_domain_role\": \"rule:cloud_admin or rule:get_domain_roles\","},{"line_number":85,"context_line":"    \"identity:list_domain_roles\": \"rule:cloud_admin or rule:list_domain_roles\","},{"line_number":86,"context_line":"    \"identity:create_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_domain_role\","},{"line_number":87,"context_line":"    \"identity:update_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_target_domain_role\","},{"line_number":88,"context_line":"    \"identity:delete_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_target_domain_role\","},{"line_number":89,"context_line":"    \"get_domain_roles\": \"rule:domain_admin_matches_target_domain_role or rule:project_admin_matches_target_domain_role\","},{"line_number":90,"context_line":"    \"list_domain_roles\": \"rule:domain_admin_matches_filter_on_list_domain_roles or rule:project_admin_matches_filter_on_list_domain_roles\","},{"line_number":91,"context_line":"    \"domain_admin_matches_domain_role\": \"rule:admin_required and domain_id:%(role.domain_id)s\","},{"line_number":92,"context_line":"    \"domain_admin_matches_target_domain_role\": \"rule:admin_required and domain_id:%(target.role.domain_id)s\","},{"line_number":93,"context_line":"    \"domain_admin_matches_filter_on_list_domain_roles\": \"rule:admin_required and domain_id:%(domain_id)s\","},{"line_number":94,"context_line":"    \"project_admin_matches_target_domain_role\": \"rule:admin_required and project_domain_id:%(target.role.domain_id)s\","},{"line_number":95,"context_line":"    \"project_admin_matches_filter_on_list_domain_roles\": \"rule:admin_required and project_domain_id:%(domain_id)s\","},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"    \"identity:get_implied_role\": \"rule:cloud_admin\","},{"line_number":98,"context_line":"    \"identity:list_implied_roles\": \"rule:cloud_admin\","}],"source_content_type":"application/json","patch_set":17,"id":"3a57f1b5_dbad1b9c","line":95,"range":{"start_line":84,"start_character":4,"end_line":95,"end_character":115},"in_reply_to":"3a57f1b5_58e05196","updated":"2016-02-12 08:45:20.000000000","message":"I\u0027ve changed it to what I *think* you meant! Let me know if didn\u0027t quite follow your line of reasoning.","commit_id":"238a792499163c6231fd1cac0f0d08447897810b"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"439a0d3638988159aefa4d7edc33a077359fec03","unresolved":false,"context_lines":[{"line_number":81,"context_line":"    \"identity:update_role\": \"rule:cloud_admin\","},{"line_number":82,"context_line":"    \"identity:delete_role\": \"rule:cloud_admin\","},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"    \"identity:get_domain_role\": \"rule:cloud_admin or rule:get_domain_roles\","},{"line_number":85,"context_line":"    \"identity:list_domain_roles\": \"rule:cloud_admin or rule:list_domain_roles\","},{"line_number":86,"context_line":"    \"identity:create_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_domain_role\","},{"line_number":87,"context_line":"    \"identity:update_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_target_domain_role\","},{"line_number":88,"context_line":"    \"identity:delete_domain_role\": \"rule:cloud_admin or rule:domain_admin_matches_target_domain_role\","},{"line_number":89,"context_line":"    \"get_domain_roles\": \"rule:domain_admin_matches_target_domain_role or rule:project_admin_matches_target_domain_role\","},{"line_number":90,"context_line":"    \"list_domain_roles\": \"rule:domain_admin_matches_filter_on_list_domain_roles or rule:project_admin_matches_filter_on_list_domain_roles\","},{"line_number":91,"context_line":"    \"domain_admin_matches_domain_role\": \"rule:admin_required and domain_id:%(role.domain_id)s\","},{"line_number":92,"context_line":"    \"domain_admin_matches_target_domain_role\": \"rule:admin_required and domain_id:%(target.role.domain_id)s\","},{"line_number":93,"context_line":"    \"domain_admin_matches_filter_on_list_domain_roles\": \"rule:admin_required and domain_id:%(domain_id)s\","},{"line_number":94,"context_line":"    \"project_admin_matches_target_domain_role\": \"rule:admin_required and project_domain_id:%(target.role.domain_id)s\","},{"line_number":95,"context_line":"    \"project_admin_matches_filter_on_list_domain_roles\": \"rule:admin_required and project_domain_id:%(domain_id)s\","},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"    \"identity:get_implied_role\": \"rule:cloud_admin\","},{"line_number":98,"context_line":"    \"identity:list_implied_roles\": \"rule:cloud_admin\","}],"source_content_type":"application/json","patch_set":17,"id":"3a57f1b5_2ad2c25c","line":95,"range":{"start_line":84,"start_character":4,"end_line":95,"end_character":115},"in_reply_to":"3a57f1b5_dbad1b9c","updated":"2016-02-12 16:11:56.000000000","message":"I meant independent rules come first.\n\n    A: \"role:x\",\n    B: \"A or role:r\",\n    C: \"role:y\",\n    D: \"B or C\"\n\nMakes sense ?","commit_id":"238a792499163c6231fd1cac0f0d08447897810b"}],"keystone/assignment/controllers.py":[{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"7065fd267eaf43a77c19c0fd80e4e81d1d094822","unresolved":false,"context_lines":[{"line_number":332,"context_line":"        # global roles, so we set the domain_id filter to None."},{"line_number":333,"context_line":"        params \u003d context[\u0027query_string\u0027]"},{"line_number":334,"context_line":"        if \u0027domain_id\u0027 not in params:"},{"line_number":335,"context_line":"            context[\u0027query_string\u0027][\u0027domain_id\u0027] \u003d None"},{"line_number":336,"context_line":""},{"line_number":337,"context_line":"        if context[\u0027query_string\u0027][\u0027domain_id\u0027] is not None:"},{"line_number":338,"context_line":"            return self.list_domain_roles(context)"}],"source_content_type":"text/x-python","patch_set":21,"id":"dae33548_26ddb20e","line":335,"range":{"start_line":335,"start_character":12,"end_line":335,"end_character":35},"updated":"2016-02-16 19:48:04.000000000","message":"Couldn\u0027t use \u0027params\u0027 here ?","commit_id":"a16287af5b7761c8453b2a8e278d78652497377c"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"7065fd267eaf43a77c19c0fd80e4e81d1d094822","unresolved":false,"context_lines":[{"line_number":334,"context_line":"        if \u0027domain_id\u0027 not in params:"},{"line_number":335,"context_line":"            context[\u0027query_string\u0027][\u0027domain_id\u0027] \u003d None"},{"line_number":336,"context_line":""},{"line_number":337,"context_line":"        if context[\u0027query_string\u0027][\u0027domain_id\u0027] is not None:"},{"line_number":338,"context_line":"            return self.list_domain_roles(context)"},{"line_number":339,"context_line":"        else:"},{"line_number":340,"context_line":"            return self.list_roles(context)"}],"source_content_type":"text/x-python","patch_set":21,"id":"dae33548_06d86e1c","line":337,"range":{"start_line":337,"start_character":11,"end_line":337,"end_character":34},"updated":"2016-02-16 19:48:04.000000000","message":"and here ?","commit_id":"a16287af5b7761c8453b2a8e278d78652497377c"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"7065fd267eaf43a77c19c0fd80e4e81d1d094822","unresolved":false,"context_lines":[{"line_number":362,"context_line":"        return self._get_role(context, role_id)"},{"line_number":363,"context_line":""},{"line_number":364,"context_line":"    def update_role_wrapper(self, context, role_id, role):"},{"line_number":365,"context_line":"        # Since we don\u0027t allow you change whether a role is global or domain"},{"line_number":366,"context_line":"        # specific, we can ignore the new update attributes and just look at"},{"line_number":367,"context_line":"        # the existing role."},{"line_number":368,"context_line":"        if self._is_domain_role_target(role_id):"},{"line_number":369,"context_line":"            return self.update_domain_role("}],"source_content_type":"text/x-python","patch_set":21,"id":"dae33548_a6e9c282","line":366,"range":{"start_line":365,"start_character":10,"end_line":366,"end_character":18},"updated":"2016-02-16 19:48:04.000000000","message":"That doesn\u0027t matter, we only need to check on the existing role anyways because that is the entity we are operating on, so that\u0027s what define what policy entry to enforce","commit_id":"a16287af5b7761c8453b2a8e278d78652497377c"}],"keystone/tests/unit/test_v3_protection.py":[{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"2a3114e107f85a7416cf1dc4ba609899d140fdb3","unresolved":false,"context_lines":[{"line_number":1624,"context_line":"            password\u003dself.cloud_admin_user[\u0027password\u0027],"},{"line_number":1625,"context_line":"            project_id\u003dself.admin_project[\u0027id\u0027])"},{"line_number":1626,"context_line":""},{"line_number":1627,"context_line":"        self._domain_role_management_cases(self.domainA[\u0027id\u0027])"},{"line_number":1628,"context_line":""},{"line_number":1629,"context_line":"    def test_domain_role_management_with_domain_admin(self):"},{"line_number":1630,"context_line":"        # A domain admin user should only be able to manipulate the domain"}],"source_content_type":"text/x-python","patch_set":16,"id":"3a57f1b5_570f25e1","line":1627,"updated":"2016-02-10 16:30:08.000000000","message":"Maybe add \"self._domain_role_management_cases(self.domainB[\u0027id\u0027])\" too ?","commit_id":"7bca1518df7323ce461161f98c035516f6bf07f5"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"2a3114e107f85a7416cf1dc4ba609899d140fdb3","unresolved":false,"context_lines":[{"line_number":1656,"context_line":"            password\u003dself.project_adminB_user[\u0027password\u0027],"},{"line_number":1657,"context_line":"            project_id\u003dself.projectB[\u0027id\u0027])"},{"line_number":1658,"context_line":""},{"line_number":1659,"context_line":"        # Try access the domain specific roless in another domain"},{"line_number":1660,"context_line":"        self._domain_role_management_cases("},{"line_number":1661,"context_line":"            self.domainA[\u0027id\u0027], expected\u003dexception.ForbiddenAction.code)"},{"line_number":1662,"context_line":""}],"source_content_type":"text/x-python","patch_set":16,"id":"3a57f1b5_972cbd4b","line":1659,"range":{"start_line":1659,"start_character":41,"end_line":1659,"end_character":47},"updated":"2016-02-10 16:30:08.000000000","message":"(nit) roles","commit_id":"7bca1518df7323ce461161f98c035516f6bf07f5"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"2a3114e107f85a7416cf1dc4ba609899d140fdb3","unresolved":false,"context_lines":[{"line_number":1660,"context_line":"        self._domain_role_management_cases("},{"line_number":1661,"context_line":"            self.domainA[\u0027id\u0027], expected\u003dexception.ForbiddenAction.code)"},{"line_number":1662,"context_line":""},{"line_number":1663,"context_line":"        # ...but they should be ablet to work with those in their own domain"},{"line_number":1664,"context_line":"        self.auth \u003d self.build_authentication_request("},{"line_number":1665,"context_line":"            user_id\u003dself.project_admin_user[\u0027id\u0027],"},{"line_number":1666,"context_line":"            password\u003dself.project_admin_user[\u0027password\u0027],"}],"source_content_type":"text/x-python","patch_set":16,"id":"3a57f1b5_371e290d","line":1663,"range":{"start_line":1663,"start_character":32,"end_line":1663,"end_character":37},"updated":"2016-02-10 16:30:08.000000000","message":"(nit) able","commit_id":"7bca1518df7323ce461161f98c035516f6bf07f5"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"2a3114e107f85a7416cf1dc4ba609899d140fdb3","unresolved":false,"context_lines":[{"line_number":1668,"context_line":""},{"line_number":1669,"context_line":"        self._domain_role_management_cases("},{"line_number":1670,"context_line":"            self.domainA[\u0027id\u0027], read_status_OK\u003dTrue,"},{"line_number":1671,"context_line":"            expected\u003dexception.ForbiddenAction.code)"}],"source_content_type":"text/x-python","patch_set":16,"id":"3a57f1b5_f71731eb","line":1671,"range":{"start_line":1671,"start_character":21,"end_line":1671,"end_character":51},"updated":"2016-02-10 16:30:08.000000000","message":"What does this expected\u003dexception.ForbiddenAction.code mean here ?\nShouldn\u0027t he be able to do such op in his domain?\n\nPlease add a comment","commit_id":"7bca1518df7323ce461161f98c035516f6bf07f5"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"7065fd267eaf43a77c19c0fd80e4e81d1d094822","unresolved":false,"context_lines":[{"line_number":1600,"context_line":"        self._role_management_cases()"},{"line_number":1601,"context_line":""},{"line_number":1602,"context_line":"    def test_domain_role_management_no_admin_no_rights(self):"},{"line_number":1603,"context_line":"        # A non-admin domain user shouldn\u0027t be able to manipulate domain roles"},{"line_number":1604,"context_line":"        self.auth \u003d self.build_authentication_request("},{"line_number":1605,"context_line":"            user_id\u003dself.just_a_user[\u0027id\u0027],"},{"line_number":1606,"context_line":"            password\u003dself.just_a_user[\u0027password\u0027],"},{"line_number":1607,"context_line":"            domain_id\u003dself.domainA[\u0027id\u0027])"},{"line_number":1608,"context_line":""},{"line_number":1609,"context_line":"        self._domain_role_management_cases("},{"line_number":1610,"context_line":"            self.domainA[\u0027id\u0027], expected\u003dexception.ForbiddenAction.code)"},{"line_number":1611,"context_line":""},{"line_number":1612,"context_line":"        # ...and nor should non-admin project user"},{"line_number":1613,"context_line":"        self.auth \u003d self.build_authentication_request("},{"line_number":1614,"context_line":"            user_id\u003dself.just_a_user[\u0027id\u0027],"},{"line_number":1615,"context_line":"            password\u003dself.just_a_user[\u0027password\u0027],"},{"line_number":1616,"context_line":"            project_id\u003dself.project[\u0027id\u0027])"},{"line_number":1617,"context_line":""},{"line_number":1618,"context_line":"        self._domain_role_management_cases("},{"line_number":1619,"context_line":"            self.domainA[\u0027id\u0027], expected\u003dexception.ForbiddenAction.code)"},{"line_number":1620,"context_line":""},{"line_number":1621,"context_line":"    def test_domain_role_management_with_cloud_admin(self):"},{"line_number":1622,"context_line":"        # A cloud admin user should have rights to manipulate domain roles"}],"source_content_type":"text/x-python","patch_set":21,"id":"dae33548_49cba71e","line":1619,"range":{"start_line":1603,"start_character":0,"end_line":1619,"end_character":72},"updated":"2016-02-16 19:48:04.000000000","message":"Maybe assert they can\u0027t do that for another domain too ?","commit_id":"a16287af5b7761c8453b2a8e278d78652497377c"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"7065fd267eaf43a77c19c0fd80e4e81d1d094822","unresolved":false,"context_lines":[{"line_number":1619,"context_line":"            self.domainA[\u0027id\u0027], expected\u003dexception.ForbiddenAction.code)"},{"line_number":1620,"context_line":""},{"line_number":1621,"context_line":"    def test_domain_role_management_with_cloud_admin(self):"},{"line_number":1622,"context_line":"        # A cloud admin user should have rights to manipulate domain roles"},{"line_number":1623,"context_line":"        self.auth \u003d self.build_authentication_request("},{"line_number":1624,"context_line":"            user_id\u003dself.cloud_admin_user[\u0027id\u0027],"},{"line_number":1625,"context_line":"            password\u003dself.cloud_admin_user[\u0027password\u0027],"},{"line_number":1626,"context_line":"            project_id\u003dself.admin_project[\u0027id\u0027])"},{"line_number":1627,"context_line":""},{"line_number":1628,"context_line":"        self._domain_role_management_cases(self.domainA[\u0027id\u0027])"},{"line_number":1629,"context_line":""},{"line_number":1630,"context_line":"    def test_domain_role_management_with_domain_admin(self):"},{"line_number":1631,"context_line":"        # A domain admin user should only be able to manipulate the domain"}],"source_content_type":"text/x-python","patch_set":21,"id":"dae33548_e9039b40","line":1628,"range":{"start_line":1622,"start_character":0,"end_line":1628,"end_character":62},"updated":"2016-02-16 19:48:04.000000000","message":"Maybe try in another domain too to show it is works regardless the domain being used ?","commit_id":"a16287af5b7761c8453b2a8e278d78652497377c"}]}